SockAnalystSupermarket freezers hacked overnight in Belgium and Sweden
SockAnalyst · Security+ certified analyst.
What happened
Refrigeration systems at about 40 Delhaize stores in Belgium had their settings tampered with overnight, and Delhaize calls it an IT incident; staff paused the forced defrost to save food. Carrefour Belgium reports 15 stores hit. In Sweden, ICA and Coop say freezer temperatures rose sharply at several stores, and one store says its units were set to 50°C. It follows last month's attacks on cooling units at hundreds of French supermarkets.
Who's affected
Supermarkets and any business running internet-connected refrigeration or building-control systems.
✅ Fix / patch
- Inventory connected fridge and HVAC controllers and take them off the open internet or put them behind a VPN.
- Change default passwords on controller web interfaces.
- Alert on setpoint or defrost changes outside maintenance windows.
🔎 Quick hunt check
No published indicators. Check firewall logs for inbound access to refrigeration or building-control web interfaces, and review controller logs for remote setpoint changes overnight Nov 1-2.
MITRE ATT&CK: T0883, T0836, T0831
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=firewall action=allowed direction=inbound dest_port IN (80,443,502,1911,4911,8080,47808)
dest_category="ot_refrigeration"
| stats count min(_time) as first max(_time) as last by src_ip, dest_ip, dest_port
| sort - countCommonSecurityLog
| where DeviceAction in~ ("allow","accept") and DestinationPort in (80,443,502,1911,4911,8080,47808)
| where DestinationIP in (_GetWatchlist('RefrigerationControllers') | project SearchKey)
| summarize count(), min(TimeGenerated), max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- Attackers set French blood bank plasma freezers to 110°C through refrigeration vendor Coolworld · OT / Healthcare · 2026-11-04
- VOLTA infostealer uses AI models to rank victims by what they're worth · Malware · 2026-11-02
- HYBE breach: hackers got in through a vendor's document-preview tool · Breach · 2026-11-02
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free